DF-3423 — VERDICT

Status: reproduced (impact: panic — including a demonstrated unbounded kernel-heap bcopy overwrite effective on any kernel). Confidence: certain.

What was run

Same guest/kernel/module as DF-3422 (env.txt). Tunnel put in MOBILE mode with ifconfig gre0 -link0 up (gre_ioctl SIOCSIFFLAGS → g_proto = IPPROTO_MOBILE, if_gre.c:461-470; encap re-attached with in_mobile_protosw, if_gre.c:563-566).

Baseline results

• mobile — outer ip_len=28 (20 IP + 8-byte mobile header, S-bit clear, checksum crafted to 0). This is a well-formed minimal mobile-GRE packet; the decap's ip->ip_len = ntohs(...)+sizeof(struct ip)-msiz (ip_gre.c:247) claims 40 bytes for a 20-byte mbuf (the "+20" double-counts the outer header; the comment's rip_input premise does not hold on DragonFly), and since neither M_HASH nor M_LENCHECKED is ever cleared (ip_gre.c:259-261), ip_input trusts it: panic: mbuf too short — ip_input+0xfaf (KASSERT ip_input.c:576), backtrace ip_input ← netmsg_service_loop (panic.mobile.txt). Deterministic for ANY valid mobile-GRE packet — mobile tunnels cannot work on INVARIANTS kernels; on production kernels every decapped packet is processed with ip_len 20 bytes longer than the data (in-cluster OOB reads by transports).
• mobileuflow — outer ip_len=20 (NO mobile header; the 8 "header" bytes are read from the frame padding past ip_len, checksum still valid). msiz=8 ⇒ bcopy(src, dst, m->m_len - msiz - (ip->ip_hl<<2)) = bcopy(..., -8) (ip_gre.c:237-238) ⇒ (size_t)-8: panic: overflowed mbuf 0xfffff80117e0c400 with SECONDARY PANIC ON CPU 0 in m_free ← sosendtcp ← soo_write ← kern_pwritev (panic.mobileuflow.txt): the unbounded copy had smashed neighbouring kernel heap objects — the ssh session's own mbuf came back with corrupted metadata. On a production kernel the m_free INVARIANTS check is absent: this is a silent, unbounded, attacker-initiated kernel-heap overwrite (source bytes partially attacker-controlled via the frame), i.e. a genuine memory-corruption primitive, not just a DoS.

Fix validation

fix.diff (shared with DF-3422, ip_gre.c only): guard m->m_len >= (ip->ip_hl<<2) + msiz before the checksum/bcopy; ip->ip_len corrected to ntohs(ip->ip_len) - msiz; M_HASH|M_LENCHECKED cleared before netisr_queue. Rebuilt if_gre.ko, re-ran both variants + 20 stress injections: no panic, guest up, dmesg clean (run.patched.log). fix_status: fixed.

Escalation note

The mobileuflow primitive (huge ascending kernel copy whose source prefix is attacker-controlled frame bytes) is the strongest of the batch; turning it into a controlled uid=0 chain would require heap-layout steering of the copy direction/extent — the bcopy copies upward through the direct map with a fixed relationship between src and dst (dst = src - msiz), so every byte between them is preserved while everything above the source range is overwritten by higher memory — a destructive smear rather than a surgical write. We characterize it and stop there; the fix removes the primitive entirely.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.